Traceroute from a windows box (linux does traceroutes differently in
terms of packets) through a Watchguard firebox has been broken for
years... I think since version 7. It wasn't until the 11th patch of
version 10 (just recently released) that they fixed it.

Of course v11 is out now as well and it wouldn't surprise me if they
broke it again. 3 major releases and probably 20 service packs was all
it took.